What LocalCommander processes
Depending on the action you request, LocalCommander may transiently process account identifiers, connected-device identifiers, tool names, request IDs, file paths or selected file content, screenshots, window metadata, clipboard content and browser page content.
Why the data is processed
Data is processed to authenticate and authorize the user, route a request to the correct compatible connected device, execute the requested workflow, return the result, meter plan usage, prevent abuse and maintain service reliability.
What is stored by the service
LocalCommander stores account identifiers, plan and usage counters, connected-device records, hashed connection and OAuth credentials, OAuth client metadata and support tickets. Device credentials are stored locally using operating-system protected storage: Windows protected user storage on Windows and Android Keystore-backed encryption on Android.
Windows device identity and Free misuse prevention
When a Windows device connects, the authenticated companion may read its Windows installation identifier (MachineGuid) solely to enforce device/account limits and detect token transfer. The gateway converts it immediately into a server-secret HMAC hash; the raw identifier is not stored or returned to ChatGPT. Pseudonymous claims expire after 180 days unless renewed. Claims may remain after account deletion during this period to prevent repeated Free signups. Contact support for legitimate device transfers, deletion or correction requests.
Optional acquisition-source measurement
Only after you accept, a first-party signed cookie stores a source category (such as Google), landing-page category and an lc-* campaign code for 30 days. It contains no unique visitor ID, full URLs, search terms or account identifiers. For a newly created account, the source may be linked at first verified sign-in to aggregated activation/payment reports for up to 90 days. A scheduled hourly database purge removes expired source mappings. Existing accounts are not re-attributed. Declining does not affect functionality. Use the source-measurement settings at the bottom of the site to withdraw; sign in to remove an already bound account mapping. This is separate from Vercel aggregate site analytics.
Execution payloads
The gateway is designed to route tool requests and results rather than archive their contents. Usage metering records tool names and call counts, not tool arguments, file bodies, screenshots, clipboard values or browser page contents. Operational logs may contain request metadata and non-secret error information needed to diagnose failures.
Remote execution
Windows and Android agents initiate outbound encrypted connections and require no public inbound port. LocalCommander account and OAuth bearer tokens are not forwarded to device agents; an agent receives only its device-scoped credential and routed tasks.
Authentication and billing
Account authentication is handled through Google Cloud Identity Platform. Paid-plan checkout and subscription management may be handled by Stripe when billing is enabled. Those providers process their own service data under their respective privacy terms.
Retention and deletion
Account, device and entitlement records are kept while needed to provide the service. Revoked device records and usage history may be retained for security, billing and abuse-prevention purposes. Support requests are retained while needed to resolve and document the request. A user may request account-data deletion through the support channel, subject to records that must be kept for legal, fraud-prevention or billing purposes.
User controls
Users can disconnect an AI client, revoke connected devices, sign out, rotate device credentials by revoking and reconnecting a device, and request account-data deletion.
Privacy or security request
Use the public LocalCommander support form and choose Privacy or Security. Do not include passwords, access tokens or recovery codes.